78 points by security_researcher 6 months ago flag hide 15 comments
johnsmith 6 months ago next
[HN Story Title] Node.js Security: Core Vulnerabilities, Best Practices and Beyond is out. After reading this, here are my thoughts...
johnsmith 6 months ago next
As a developer, I think it's crucial to stay updated on Node.js security issues and best practices. This post highlighting core vulnerabilities and then providing best practices is a great resource for the community.
jobsprogrammer 6 months ago next
This is a great point, securityexpert. Another thing to consider is using tools like NPM Audit or snyk to automatically detect security issues with your dependencies and get fixes.
securityexpert 6 months ago prev next
One thing I would like to add to the best practices section: Make sure you are using the latest version of Node.js and regularly updating your packages. This can mitigate a lot of security vulnerabilities before they even arise.
securecoding 6 months ago next
Absolutely! Here's another tool you can use: nsp (npm Security Platform). It has continuously passing builds and is permissionless to add to any repo. It will stop any of your ci pushes if it finds high severities.
backendmaster 6 months ago prev next
When it comes to Node.js, security is always one of my top priorities. I implement a variety of best practices to minimize the risk. This post is a must-read.
janejane 6 months ago next
The post mentions Express.js as a popular Node.js web app framework. I personally recommend using Helmet.js for a range of security features, including http security headers and CSP headers.
webdeveloper1 6 months ago prev next
Great post! Here is a list of additional Node.js security best practices that I always keep in mind when coding.
webdeveloper1 6 months ago next
1. Limit permissions for file system operations, network operations, or any operations that require permissions.
webdeveloper1 6 months ago prev next
2. Enable strict mode in Node.js code to ensure that variables and functions are scoped correctly and avoid any unexpected global variable changes.
webdeveloper1 6 months ago prev next
3. Use ES2015+ features for dependency management, like using object rest and spread properties, or spreading the utility module when needed. This approach can help reduce the number of dependencies.
webdeveloper1 6 months ago prev next
4. Regularly update dependencies and make sure to remove unnecessary packages to reduce the risk of vulnerabilities.
webdeveloper1 6 months ago prev next
5. Consider using a code coverage analysis tool, like istanbul or cupcake, to automatically generate code coverage reports. This can help identify potential security gaps.
jpenner 6 months ago prev next
I would also recommend using libraries and tools that adhere to the OWASP Security Principles, like MongoDB Connector for Node.js and the Express Framework.
webdeveloper1 6 months ago next
100% agreed, jpenner. When choosing libraries or tools, always consider their security properties and how well they align with the OWASP Security Principles.